CVE-2026-46698: CWE-918: Server-Side Request Forgery (SSRF) in stefanbohacek fediverse-embeds-wordpress-plugin
Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.9, Fediverse Embeds registered the unauthenticated AJAX action wp_ajax_nopriv_ftf_get_site_info (includes/Site_Info.php) that verified a nonce ftf-fediverse-embeds-nonce and then called file_get_html($site_url) on the attacker-supplied URL. The same nonce was enqueued onto every public page containing a fediverse embed (via includes/Enqueue_Assets.php lines 41-46 + includes/Helpers.php lines 64-83), so the nonce gate was not an authentication boundary; any visitor of a public post with an embed could grab it and reuse it. This issue has been patched in version 1.5.9.
AI Analysis
Technical Summary
The fediverse-embeds WordPress plugin registered an unauthenticated AJAX action 'wp_ajax_nopriv_ftf_get_site_info' that verified a nonce but the nonce was publicly accessible on pages with embeds, making it ineffective as an authentication barrier. This allowed any visitor to reuse the nonce and cause the server to fetch attacker-supplied URLs via the file_get_html function, leading to a Server-Side Request Forgery (CWE-918). The issue was fixed in version 1.5.9.
Potential Impact
An attacker can cause the server to make HTTP requests to arbitrary URLs, potentially accessing internal resources or services not otherwise accessible externally. The vulnerability does not impact integrity or availability directly but can lead to information disclosure through SSRF.
Mitigation Recommendations
Upgrade the fediverse-embeds WordPress plugin to version 1.5.9 or later, where this SSRF vulnerability has been patched. No other mitigations are indicated by the vendor advisory.
CVE-2026-46698: CWE-918: Server-Side Request Forgery (SSRF) in stefanbohacek fediverse-embeds-wordpress-plugin
Description
Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.9, Fediverse Embeds registered the unauthenticated AJAX action wp_ajax_nopriv_ftf_get_site_info (includes/Site_Info.php) that verified a nonce ftf-fediverse-embeds-nonce and then called file_get_html($site_url) on the attacker-supplied URL. The same nonce was enqueued onto every public page containing a fediverse embed (via includes/Enqueue_Assets.php lines 41-46 + includes/Helpers.php lines 64-83), so the nonce gate was not an authentication boundary; any visitor of a public post with an embed could grab it and reuse it. This issue has been patched in version 1.5.9.
CVSS v3.1
Score 5.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The fediverse-embeds WordPress plugin registered an unauthenticated AJAX action 'wp_ajax_nopriv_ftf_get_site_info' that verified a nonce but the nonce was publicly accessible on pages with embeds, making it ineffective as an authentication barrier. This allowed any visitor to reuse the nonce and cause the server to fetch attacker-supplied URLs via the file_get_html function, leading to a Server-Side Request Forgery (CWE-918). The issue was fixed in version 1.5.9.
Potential Impact
An attacker can cause the server to make HTTP requests to arbitrary URLs, potentially accessing internal resources or services not otherwise accessible externally. The vulnerability does not impact integrity or availability directly but can lead to information disclosure through SSRF.
Mitigation Recommendations
Upgrade the fediverse-embeds WordPress plugin to version 1.5.9 or later, where this SSRF vulnerability has been patched. No other mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-15T23:26:58.308Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a2af7a8815e7002b8172387
Added to database: 06/11/2026, 18:00:08 UTC
Last enriched: 06/11/2026, 18:15:23 UTC
Last updated: 07/14/2026, 19:47:33 UTC
Views: 60
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.